@team-semicolon/semicolony-cli 4.18.104 → 4.18.106

package/migrations/204_record_meeting_overload_repair.sql

@@ -0,0 +1,463 @@
+-- 204_record_meeting_overload_repair.sql
+--
+-- Two `record_meeting` overloads exist on the live operator database and every
+-- meeting recording is failing. Measured 2026-08-13 against production:
+--
+--   semo_ops.record_meeting(text,date,text,text,text,text,jsonb,text,text,jsonb,text,text,text)
+--   semo_ops.record_meeting(text,date,text,text,text,text,jsonb,text,text,jsonb,text,text,text,text,integer)
+--
+-- How they came to coexist: 202_meeting_record_discussion_provenance.sql (dev)
+-- dropped the 13-argument signature and created the 15-argument one, adding
+-- p_discussion_url/p_discussion_number with DEFAULT NULL. Forty-nine minutes
+-- later 203_action_item_redesign_cutover.sql ran `CREATE OR REPLACE` on the
+-- 13-argument signature -- written before that branch existed, and correct in
+-- isolation -- which recreated the overload the earlier migration had removed.
+-- The same collision reproduces on a fresh install, because the runner applies
+-- these files in filename order (202_meeting... < 202_team... < 203) and 203
+-- therefore always lands last.
+--
+-- Both live callers -- packages/kb-gateway/src/lib/meeting-service.ts:45 and
+-- packages/cli/src/commands/meetings.ts:181 -- pass exactly 13 positional
+-- parameters, and node-pg sends them untyped. Because the 15-argument version's
+-- last two parameters are defaulted, a 13-argument call is a legal candidate for
+-- both, and PostgreSQL refuses to choose:
+--
+--   ERROR:  function semo_ops.record_meeting(unknown, unknown, ..., jsonb, ...)
+--           is not unique
+--   HINT:  Could not choose a best candidate function.
+--
+-- Reproduced 2026-08-13 on a throwaway PostgreSQL 16.14 loaded from the
+-- production schema dump with 202_meeting_record_discussion_provenance,
+-- 202_team_members_record_of_authority and 203 applied in the live order.
+--
+-- Why one function with the 15-argument signature, and not the other way round:
+--
+--   * The 15-argument signature is the newer canonical one and carries real
+--     data -- discussion_url/discussion_number are how a migrated record points
+--     back at the Discussion it was built from, which Phase 2's backfill of 205
+--     Meeting-Minutes Discussions depends on. Dropping it to keep the narrower
+--     signature would delete a capability.
+--   * Its body, however, still writes the pre-redesign action-item shape:
+--     INSERT INTO action_items (owner_domain, target_domain, description,
+--     assignee, deadline, priority, status, source, meeting_id, ...) -- eight
+--     columns 203 removed. Dropping only *our* 13-argument overload would
+--     restore unambiguous resolution and leave meeting recording broken a
+--     different way, at first execution rather than at migration time (a
+--     PL/pgSQL body's column references resolve on first call, not at CREATE).
+--
+-- So: the 15-argument signature and everything it owns -- the validations, the
+-- meetings upsert including the discussion-provenance columns, the Knowledge
+-- Fabric projection with its restricted-classification metadata, the
+-- delete-and-recreate idempotency, and the four-column receipt -- are carried
+-- over unchanged from 202_meeting_record_discussion_provenance. The action-item
+-- half is carried over unchanged from 203: create_action_item, the typed
+-- meeting_id stamp, source_kind='meeting' with source_ref, the
+-- project/assignee/deadline/priority fallbacks, and the meeting_import evidence
+-- recorded in action_items.metadata and meetings.metadata. Neither half is
+-- redesigned here; this file only puts them in the same function.
+--
+-- Statement order is load-bearing. The replace comes first, so the 15-argument
+-- function is already correct before the 13-argument one goes away; there is
+-- never a moment with no working record_meeting. (The runner wraps the file in
+-- one transaction, so the intermediate state is not observable to anyone else
+-- either -- but the order is still written to be correct without that.)
+--
+-- The runner owns the transaction boundary, so no BEGIN/COMMIT here, and it
+-- retargets the `semicolony.` qualifier to the active schema.
+
+CREATE OR REPLACE FUNCTION semicolony.record_meeting(
+  p_title text,
+  p_meeting_date date,
+  p_meeting_type text,
+  p_adhoc_subtype text,
+  p_visibility text,
+  p_target_domain text,
+  p_attendees jsonb,
+  p_record_body text,
+  p_transcript text,
+  p_action_items jsonb,
+  p_record_source text,
+  p_worker_id text,
+  p_device_id text,
+  p_discussion_url text DEFAULT NULL,
+  p_discussion_number integer DEFAULT NULL
+)
+RETURNS TABLE(meeting_id uuid, kb_id bigint, action_item_ids uuid[], duplicate boolean)
+LANGUAGE plpgsql
+SECURITY DEFINER
+SET search_path = pg_catalog
+AS $function$
+DECLARE
+  v_meeting_id uuid;
+  v_kb_id bigint;
+  v_existing uuid;
+  v_norm text;
+  v_sensitivity text;
+  v_sub_key text;
+  v_item jsonb;
+  v_item_id uuid;
+  v_description text;
+  v_priority text;
+  v_project text;
+  v_candidate text;
+  v_assignee_kind text;
+  v_assignee_member text;
+  v_assignee_agent text;
+  v_external_contact text;
+  v_deadline date;
+  -- Y1: fallbacks are recorded as data, not only as a log line. v_fallbacks
+  -- accumulates per item and lands in that item's own metadata; v_skipped
+  -- accumulates items that produced no row at all and lands on the meeting.
+  v_fallbacks jsonb;
+  v_skipped jsonb;
+BEGIN
+  IF p_title IS NULL OR length(btrim(p_title)) < 3 THEN
+    RAISE EXCEPTION 'title must be at least 3 characters';
+  END IF;
+  IF p_meeting_date IS NULL THEN
+    RAISE EXCEPTION 'meeting_date is required';
+  END IF;
+  IF p_visibility IS NULL OR p_visibility NOT IN ('team', 'restricted') THEN
+    RAISE EXCEPTION 'visibility must be team or restricted, got %', p_visibility;
+  END IF;
+  IF p_record_source IS NULL
+     OR p_record_source NOT IN ('slack-worker', 'operator', 'backfill-discussion') THEN
+    RAISE EXCEPTION 'invalid record_source %', p_record_source;
+  END IF;
+  IF p_record_body IS NULL OR length(btrim(p_record_body)) = 0 THEN
+    RAISE EXCEPTION 'record_body is required';
+  END IF;
+
+  v_norm := lower(regexp_replace(btrim(p_title), '\s+', ' ', 'g'));
+  v_sensitivity := CASE WHEN p_visibility = 'restricted' THEN 'restricted' ELSE 'internal' END;
+
+  SELECT m.meeting_id INTO v_existing
+    FROM semicolony.meetings m
+   WHERE m.meeting_date = p_meeting_date
+     AND lower(regexp_replace(m.title, '\s+', ' ', 'g')) = v_norm;
+
+  -- Discussion provenance from 202_meeting_record_discussion_provenance,
+  -- unchanged: COALESCE on update so a re-record that omits the link does not
+  -- erase one an earlier submission established, and both columns written on
+  -- insert.
+  IF v_existing IS NOT NULL THEN
+    UPDATE semicolony.meetings m
+       SET record_body = COALESCE(p_record_body, m.record_body),
+           mapped_transcript = COALESCE(p_transcript, m.mapped_transcript),
+           visibility = p_visibility,
+           record_source = p_record_source,
+           target_domain = COALESCE(p_target_domain, m.target_domain),
+           attendees = COALESCE(p_attendees, m.attendees),
+           discussion_url = COALESCE(p_discussion_url, m.discussion_url),
+           discussion_number = COALESCE(p_discussion_number, m.discussion_number),
+           updated_at = now()
+     WHERE m.meeting_id = v_existing;
+    v_meeting_id := v_existing;
+  ELSE
+    INSERT INTO semicolony.meetings (
+      meeting_id, title, meeting_type, adhoc_subtype, meeting_date, attendees,
+      visibility, record_body, mapped_transcript, record_source, target_domain,
+      transcription_status, speaker_map, discussion_url, discussion_number,
+      created_at, updated_at
+    ) VALUES (
+      gen_random_uuid(), btrim(p_title), p_meeting_type, p_adhoc_subtype, p_meeting_date,
+      COALESCE(p_attendees, '[]'::jsonb), p_visibility, p_record_body,
+      p_transcript, p_record_source, p_target_domain,
+      'completed', '{}'::jsonb, p_discussion_url, p_discussion_number, now(), now()
+    ) RETURNING meetings.meeting_id INTO v_meeting_id;
+  END IF;
+
+  v_sub_key := to_char(p_meeting_date, 'YYYY-MM-DD') || '-' || left(v_norm, 60);
+
+  INSERT INTO semicolony.knowledge_base (
+    domain, key, sub_key, content, metadata, created_by, created_at, updated_at
+  ) VALUES (
+    COALESCE(p_target_domain, 'semicolon'),
+    'meeting',
+    v_sub_key,
+    p_record_body,
+    jsonb_build_object(
+      'classification', jsonb_build_object('sensitivity', v_sensitivity),
+      'meeting_id', v_meeting_id,
+      'meeting_date', to_char(p_meeting_date, 'YYYY-MM-DD'),
+      'record_source', p_record_source
+    ),
+    COALESCE(p_worker_id, 'meeting-worker'),
+    now(), now()
+  )
+  ON CONFLICT (domain, key, sub_key) DO UPDATE
+    SET content = EXCLUDED.content,
+        metadata = semicolony.knowledge_base.metadata || EXCLUDED.metadata,
+        updated_at = now()
+  RETURNING semicolony.knowledge_base.kb_id INTO v_kb_id;
+
+  -- Re-recording the same meeting must not duplicate its follow-ups. Existing
+  -- machine-created items for this meeting are replaced; anything a human filed
+  -- separately carries no meeting_id and is untouched. Unchanged from 199,
+  -- including the fact that the DELETE only runs when the caller actually sent
+  -- items -- a record submitted with an empty action-item list must not silently
+  -- erase the follow-ups an earlier submission of the same meeting created.
+  -- action_item_events rows disappear with their item through the events
+  -- table's ON DELETE CASCADE, so no orphan history is left behind.
+  IF p_action_items IS NOT NULL AND jsonb_typeof(p_action_items) = 'array'
+     AND jsonb_array_length(p_action_items) > 0 THEN
+    DELETE FROM semicolony.action_items a WHERE a.meeting_id = v_meeting_id;
+
+    v_skipped := '[]'::jsonb;
+
+    FOR v_item IN
+      SELECT item FROM jsonb_array_elements(p_action_items) AS item
+    LOOP
+      v_description := btrim(COALESCE(v_item ->> 'description', ''));
+      IF char_length(v_description) < 5 THEN
+        RAISE WARNING 'record_meeting: skipping meeting % action item, description shorter than 5 characters (%)',
+          v_meeting_id, v_description;
+        -- Y1: the RAISE alone is not evidence. Neither meeting-service.ts nor
+        -- meetings.ts subscribes to pg's `notice` event, so a WARNING is
+        -- visible only to someone attached with psql by hand. This item
+        -- produces no row to carry its own record, so the whole submitted
+        -- item is preserved on the meeting instead — an operator can then see
+        -- that the meeting's follow-up list is incomplete, and what was lost.
+        v_skipped := v_skipped || jsonb_build_array(jsonb_build_object(
+          'reason', 'description_shorter_than_5_characters',
+          'description', v_item ->> 'description',
+          'owner', v_item ->> 'owner',
+          'target', v_item ->> 'target',
+          'assignee', v_item ->> 'assignee',
+          'deadline', v_item ->> 'deadline',
+          'priority', v_item ->> 'priority'
+        ));
+        CONTINUE;
+      END IF;
+
+      -- Y1: reset per item. Anything appended here lands in the created row's
+      -- metadata under meeting_import.fallbacks, so the row itself answers
+      -- "why is this filed under semo-ops / due then / unassigned?".
+      v_fallbacks := '[]'::jsonb;
+
+      v_priority := COALESCE(NULLIF(btrim(v_item ->> 'priority'), ''), 'normal');
+      IF v_priority NOT IN ('low', 'normal', 'high', 'urgent') THEN
+        RAISE WARNING 'record_meeting: meeting % action item priority % is not one of low/normal/high/urgent, recording as normal',
+          v_meeting_id, v_priority;
+        v_fallbacks := v_fallbacks || jsonb_build_array(jsonb_build_object(
+          'field', 'priority',
+          'reason', 'not_in_low_normal_high_urgent',
+          'substituted', 'normal',
+          'original', v_priority
+        ));
+        v_priority := 'normal';
+      END IF;
+
+      v_project := NULL;
+      FOREACH v_candidate IN ARRAY ARRAY[
+        NULLIF(btrim(v_item ->> 'target'), ''),
+        NULLIF(btrim(v_item ->> 'owner'), ''),
+        NULLIF(btrim(p_target_domain), '')
+      ]
+      LOOP
+        CONTINUE WHEN v_candidate IS NULL;
+        IF EXISTS (SELECT 1 FROM semicolony.ontology o
+                    WHERE o.domain = v_candidate AND o.entity_type = 'service') THEN
+          v_project := v_candidate;
+          EXIT;
+        END IF;
+      END LOOP;
+      -- Y1: record the substitution before it is applied, while the rejected
+      -- candidates are still distinguishable from a deliberate 'semo-ops'.
+      IF v_project IS NULL THEN
+        RAISE WARNING 'record_meeting: meeting % action item names no entity_type=service domain (target %, owner %, meeting target %), filing under semo-ops',
+          v_meeting_id, v_item ->> 'target', v_item ->> 'owner', p_target_domain;
+        v_fallbacks := v_fallbacks || jsonb_build_array(jsonb_build_object(
+          'field', 'project_domain',
+          'reason', 'no_service_domain_among_candidates',
+          'substituted', 'semo-ops',
+          'original', jsonb_build_object(
+            'target', v_item ->> 'target',
+            'owner', v_item ->> 'owner',
+            'meeting_target_domain', p_target_domain
+          )
+        ));
+      END IF;
+      v_project := COALESCE(v_project, 'semo-ops');
+
+      v_assignee_kind   := 'unassigned';
+      v_assignee_member := NULL;
+      v_assignee_agent  := NULL;
+      FOREACH v_candidate IN ARRAY ARRAY[
+        NULLIF(btrim(v_item ->> 'assignee'), ''),
+        NULLIF(btrim(v_item ->> 'owner'), '')
+      ]
+      LOOP
+        CONTINUE WHEN v_candidate IS NULL;
+        IF EXISTS (SELECT 1 FROM semicolony.team_members tm WHERE tm.domain = v_candidate) THEN
+          v_assignee_kind   := 'team-member';
+          v_assignee_member := v_candidate;
+          EXIT;
+        ELSIF EXISTS (SELECT 1 FROM semicolony.bot_status bs WHERE bs.bot_id = v_candidate) THEN
+          v_assignee_kind  := 'agent';
+          v_assignee_agent := v_candidate;
+          EXIT;
+        END IF;
+      END LOOP;
+
+      v_external_contact := CASE WHEN v_assignee_kind = 'unassigned'
+                                 THEN NULLIF(btrim(v_item ->> 'assignee'), '')
+                                 ELSE NULL END;
+
+      -- Y1: only a *supplied* name that failed to resolve is a fallback. An
+      -- item that named nobody is simply unassigned, not a substitution, and
+      -- recording it as one would bury the real cases in noise.
+      IF v_assignee_kind = 'unassigned'
+         AND (NULLIF(btrim(v_item ->> 'assignee'), '') IS NOT NULL
+              OR NULLIF(btrim(v_item ->> 'owner'), '') IS NOT NULL) THEN
+        RAISE WARNING 'record_meeting: meeting % action item assignee (assignee %, owner %) is neither a team member nor an agent, leaving it unassigned',
+          v_meeting_id, v_item ->> 'assignee', v_item ->> 'owner';
+        v_fallbacks := v_fallbacks || jsonb_build_array(jsonb_build_object(
+          'field', 'assignee',
+          'reason', 'not_a_team_member_or_agent',
+          'substituted', 'unassigned',
+          'original', jsonb_build_object(
+            'assignee', v_item ->> 'assignee',
+            'owner', v_item ->> 'owner'
+          ),
+          'external_contact', v_external_contact
+        ));
+      END IF;
+
+      v_deadline := COALESCE(
+        NULLIF(btrim(v_item ->> 'deadline'), '')::date,
+        semicolony.action_item_default_deadline(v_priority)
+      );
+
+      -- Y1: the COALESCE above is deliberately left byte-identical (its shape
+      -- is pinned by the migration test); the fallback is detected separately
+      -- on the same condition rather than by restructuring it.
+      IF NULLIF(btrim(v_item ->> 'deadline'), '') IS NULL THEN
+        RAISE WARNING 'record_meeting: meeting % action item has no deadline, defaulting to % for priority %',
+          v_meeting_id, v_deadline, v_priority;
+        v_fallbacks := v_fallbacks || jsonb_build_array(jsonb_build_object(
+          'field', 'deadline',
+          'reason', 'absent',
+          'substituted', to_char(v_deadline, 'YYYY-MM-DD'),
+          'original', v_item ->> 'deadline',
+          'derived_from_priority', v_priority
+        ));
+      END IF;
+
+      v_item_id := semicolony.create_action_item(
+        p_description        => v_description,
+        p_project_domain     => v_project,
+        p_deadline           => v_deadline,
+        p_assignee_kind      => v_assignee_kind,
+        p_assignee_member    => v_assignee_member,
+        p_assignee_agent     => v_assignee_agent,
+        p_assignee_device    => NULL,
+        p_priority           => v_priority,
+        p_source_kind        => 'meeting',
+        p_source_ref         => v_meeting_id::text,
+        p_related_url        => NULL,
+        p_external_contact   => v_external_contact,
+        p_metadata           => jsonb_build_object(
+                                  'meeting_id', v_meeting_id,
+                                  'meeting_date', to_char(p_meeting_date, 'YYYY-MM-DD'),
+                                  'record_source', p_record_source,
+                                  'worker_id', p_worker_id,
+                                  'device_id', p_device_id,
+                                  'raw_owner', v_item ->> 'owner',
+                                  'raw_target', v_item ->> 'target',
+                                  'raw_assignee', v_item ->> 'assignee',
+                                  -- Y1: always present, empty array when the
+                                  -- item mapped cleanly, so a consumer can
+                                  -- filter on jsonb_array_length() without
+                                  -- having to distinguish absent from empty.
+                                  'meeting_import', jsonb_build_object(
+                                    'fallbacks', v_fallbacks
+                                  )
+                                ),
+        p_origin_surface     => 'system',
+        p_origin_actor_kind  => NULL,
+        p_origin_member      => NULL,
+        p_origin_agent       => NULL,
+        p_origin_device      => NULL,
+        p_origin_harness     => NULL,
+        p_origin_session_key => NULL
+      );
+
+      -- The typed relation 198 added. create_action_item deliberately has no
+      -- meeting_id parameter: meetings are one source among nine and the
+      -- function's parameter list is already twenty wide, so the linkage is
+      -- stamped here, in the same transaction, rather than widening every
+      -- caller's signature for one of them.
+      UPDATE semicolony.action_items
+         SET meeting_id = v_meeting_id
+       WHERE action_item_id = v_item_id;
+    END LOOP;
+
+    -- Y1: publish the skip list on the meeting, inside the same IF that owns
+    -- the delete-and-recreate. `||` replaces the whole meeting_import key
+    -- rather than merging into it, so a re-record with the descriptions fixed
+    -- writes back an empty array instead of leaving a stale accusation on a
+    -- meeting whose follow-up list is now complete — the evidence follows the
+    -- same idempotency rule as the items it describes. Keeping it inside the
+    -- IF also means an empty submission leaves both the items and their
+    -- evidence untouched, which is the behaviour 199 defined and verification
+    -- confirmed.
+    UPDATE semicolony.meetings m
+       SET metadata = COALESCE(m.metadata, '{}'::jsonb)
+                      || jsonb_build_object('meeting_import', jsonb_build_object(
+                           'skipped_action_items', v_skipped,
+                           'skipped_count', jsonb_array_length(v_skipped),
+                           'submitted_count', jsonb_array_length(p_action_items),
+                           'recorded_at', now(),
+                           'record_source', p_record_source
+                         )),
+           updated_at = now()
+     WHERE m.meeting_id = v_meeting_id;
+  END IF;
+
+  RETURN QUERY
+  SELECT v_meeting_id,
+         v_kb_id,
+         COALESCE(ARRAY(SELECT a.action_item_id
+                          FROM semicolony.action_items a
+                         WHERE a.meeting_id = v_meeting_id
+                         ORDER BY a.created_at), '{}'::uuid[]),
+         (v_existing IS NOT NULL);
+END;
+$function$;
+
+-- Restated from 202_meeting_record_discussion_provenance unchanged.
+--
+-- CREATE OR REPLACE preserves the existing ACL: pg_proc.proacl belongs to the
+-- pg_proc row, and REPLACE rewrites that row's prosrc/proargtypes without
+-- touching proacl (only CREATE of a genuinely new function initialises it to
+-- NULL, meaning owner-plus-PUBLIC default). The signature above is identical to
+-- the one 202_meeting_record_discussion_provenance created, so this is a
+-- replace and not a create, and the {=X/…,sc_app=X/…} entry that migration left
+-- in proacl survives -- confirmed on the reproduction by reading
+-- information_schema.routine_privileges before and after applying this file.
+-- They are restated anyway for the same reason 203 restated them: so a fresh
+-- install ending at this file has the identical grant surface, and so the
+-- sc_app contract (EXECUTE only, still no DML anywhere) is legible in the file
+-- that now owns the function body.
+REVOKE ALL ON FUNCTION semicolony.record_meeting(
+  text, date, text, text, text, text, jsonb, text, text, jsonb, text, text, text, text, integer
+) FROM PUBLIC;
+
+GRANT EXECUTE ON FUNCTION semicolony.record_meeting(
+  text, date, text, text, text, text, jsonb, text, text, jsonb, text, text, text, text, integer
+) TO sc_app;
+
+-- The overload goes away only now that its replacement is in place.
+--
+-- The type list is the full 13, spelled out: DROP FUNCTION matches on the
+-- declared argument types exactly and does not consider defaults, so this
+-- names the 13-argument function and cannot reach the 15-argument one above --
+-- which is why it is safe to write here at all, and why omitting the list (or
+-- writing a shorter prefix of it) would instead raise `function name is not
+-- unique` and leave both overloads in place. IF EXISTS so that re-running the
+-- file, or a fresh install where some future migration has already retired the
+-- narrow signature, is not an error.
+DROP FUNCTION IF EXISTS semicolony.record_meeting(
+  text, date, text, text, text, text, jsonb, text, text, jsonb, text, text, text
+);